Security Operations Manager

Role & responsibilities

• Lead and manage the Security Operations Center (SOC) and day-to-day cybersecurity operations.
• Develop and execute the organization's security operations strategy, processes, policies, and procedures.
• Monitor security events, alerts, logs, endpoints, networks, cloud environments, and applications to identify potential threats.
• Oversee security incident detection, investigation, response, containment, eradication, and recovery.
• Establish and monitor SOC SLAs, KPIs, security metrics, and operational performance.
• Lead the response to cybersecurity incidents, breaches, malware attacks, phishing, ransomware, unauthorized access, and other security threats.
• Manage and optimize SIEM, SOAR, EDR/XDR, vulnerability management, threat intelligence, and security monitoring platforms.
• Develop and maintain effective incident response, threat detection, escalation, and crisis management procedures.
• Conduct regular vulnerability assessments, threat assessments, security reviews, and risk evaluations.
• Coordinate with IT infrastructure, cloud, application, network, DevOps, compliance, and business teams to remediate security risks.
• Establish security controls and processes aligned with frameworks such as NIST, ISO 27001, CIS Controls, and MITRE ATT&CK.
• Manage cybersecurity vendors, managed security service providers (MSSPs), contracts, tools, and security operations budgets.
• Ensure effective security logging, monitoring, reporting, evidence collection, and incident documentation.
• Conduct security drills, tabletop exercises, incident simulations, and continuous improvement initiatives.
• Prepare regular security posture, incident, risk, and compliance reports for senior management.
• Ensure security operations comply with applicable regulatory, privacy, audit, and organizational requirements.
• Recruit, mentor, and develop security analysts, engineers, incident responders, and other SOC personnel.
• Stay current with emerging cyber threats, attack techniques, vulnerabilities, security technologies, and industry best practices.

Preferred candidate profile

• 5 to 10 years of experience in cybersecurity, security operations, SOC, incident response, or information security, including experience in a leadership or supervisory capacity.
• Proven experience managing SOC/security operations teams and cybersecurity incidents.
• Strong hands-on understanding of SIEM, SOAR, EDR/XDR, threat detection, incident response, vulnerability management, and threat intelligence.
• Experience with platforms such as Microsoft Sentinel, Splunk, IBM QRadar, CrowdStrike, Microsoft Defender, Palo Alto, or equivalent security technologies.
• Strong understanding of network security, endpoint security, cloud security, IAM, firewalls, encryption, application security, and security architecture.
• Experience investigating and responding to malware, phishing, ransomware, data breaches, privilege escalation, and unauthorized access incidents.
• Strong knowledge of cybersecurity frameworks including NIST, ISO 27001, CIS Controls, and MITRE ATT&CK.
• Experience with security automation, threat hunting, vulnerability management, security analytics, and incident-response processes.
• Strong understanding of risk management, security governance, compliance, audit requirements, and security policies.
• Experience managing security vendors, MSSPs, security tools, budgets, SLAs, and third-party relationships.
• Strong leadership skills with experience building, mentoring, and managing SOC analysts and cybersecurity professionals.
• Excellent incident management, crisis management, analytical thinking, problem-solving, communication, and stakeholder-management skills.
• Ability to work effectively under pressure and make timely decisions during critical security incidents.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Security, Computer Engineering, or a related field.
• Relevant certifications such as CISSP, CISM, CRISC, CEH, GIAC, Security+, ISO 27001, or cloud-security certifications are desirable.
• Experience with 247 SOC operations, global security environments, or regulated industries such as BFSI, healthcare, telecom, or government is an advantage.